Six companies.That is the list.

A sub-processor is any third party that processes customer personal data on our behalf. This is the complete list. There is no separate "affiliates" annex and no unnamed "trusted partners" category — if a company can touch your data, it is in this table.

Enrichment and verification providers process only what you submit for a specific enrichment or verification job. They do not receive your contact database, your tags, your notes, or your activity history.

Four of the six are structural: without Clerk you cannot sign in, without Hetzner and Vercel there is nothing to sign in to, and without Polar there is no paid plan. The other two are yours to switch off.

• +MillionVerifier only receives data when email verification is enabled and you run a verification job.
• +NinjaPear only receives data when enrichment is enabled and you enrich a record. Leaving enrichment unused means no identifier ever leaves the platform.

Before a provider is added, we confirm it will sign processor terms compatible with our own, that its transfer mechanism for any data leaving the EEA is documented, and that its retention and deletion behaviour is something we can explain on this page in one sentence.

Epafi is pre-launch. The providers above are the ones represented in the current application and deployment configuration; their executed processor agreements, contracted locations, and transfer terms are finalised and reflected here before the service accepts a paying customer. We would rather show you the list early and mark its status than show you nothing.

Under the DPA, we give thirty days’ notice before a new sub-processor starts processing customer data, and you may object within that window. Notice goes out by email to the account’s billing and admin contacts, and this page is updated on the same day.

To subscribe as someone who is not an account admin — a security reviewer, a DPO, a procurement contact — email subprocessors@epafi.app with the address to add. We keep that list for the sole purpose of sending these notices, and you can unsubscribe from any of them.